> Isn't this the exact same security posture as a native app with automatic updates turned on?

Inconvenient truth, but it is so to a degree. I am disturbed by the lack of attention to that by many security gurus.

One difference is that with web apps you're practically updating them every single time you launch them.